Alcatel-Lucent 7950 SR, System Management Manual

Page: 125 / 462

Security
7950 SR OS System Management Guide Page 125
TCP(6), UDP(17). IPv6 Extension headers are identified by the next header IPv6 numbers as per
RFC2460.
Parameters
next-header — Specifies for IPv4 MAF the IP protocol field, and for IPv6 the next header type to be
used in the match criteria for this Management Access Filter Entry.
Values
next-header: 0 — 255, protocol numbers accepted in DHB
keywords: none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp,
igmp, igp, ip, ipv6, ipv6-icmp, ipv6-no-nxt, isis, iso-ip, l2tp, ospf-igp, pim, pnni,
ptp, rdp, rsvp, stp, tcp, udp, vrrp
protocol
Syntax [ no ] protocol protocol-id
Context config>system>security>mgmt-access-filter>entry
Description
This command configures an IP protocol type to be used as a management access filter match crite-
rion.
The protocol type, such as TCP, UDP, and OSPF, is identified by its respective protocol number. Well-
known protocol numbers include ICMP (1), TCP (6), and UDP (17).
The no form the command removes the protocol from the match criteria.
Default
No protocol match criterion is specified.
Parameters
protocol — The protocol number for the match criterion.
Values
1 to 255 (decimal)
port
Syntax port tcp/udp port-number [ mask ]
port-list port-list-name
port range start end
no port
Context config>system-security>cpm-filter>ip-filter>entry>match
config>system>security>cpm-filter>ipv6-filter>entry>match
Description
This command configures a TCP/UDP source or destination port match criterion in IPv4 and IPv6
CPM filter policies. A packet matches this criterion if packet’s TCP/UDP (as configured by protocol/
next-header match) source OR destination port matches either the specified port value or a port in the
specified port range or port list.
This command is mutually exclusive with src-port and dst-port commands.
The no form of this command deletes the specified port match criterion.
Default
no port